Privacy Policy

Last updated: September 27, 2026

Effortless Solutions LLC, doing business as Chartless ("Chartless," "we," "us," or "our"), provides a voice-based documentation platform (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to visitors of our website and users of our dashboard and mobile application (collectively, the "Site").

For organizations on a HIPAA-enabled Enterprise plan, our Business Associate Agreement governs our handling of protected health information and controls over this Privacy Policy to the extent the two conflict.

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, and password, provided when you or your organization create an account.
• Organization information: your organization's name, join code, and subject-matter labels.
• Client/subject records: names and related information your organization chooses to store about the people or things it documents.
• Voice recordings: audio captured when you use the recording feature. As explained in Section 3, audio is processed transiently and is not stored by Chartless.
• Generated content: the structured notes and chart content produced from your dictation, which your organization retains as its records.
• Usage data: log data such as sign-in times, device/browser type, and, for organizations on a HIPAA-enabled Enterprise plan, records of when transcription services were used.
• Diagnostic data: if the Service encounters an unexpected error, technical information about that error (such as an error message and the general application state) is sent to our error-monitoring provider to help us identify and fix the issue. This is configured to exclude request content, cookies, and query strings.
• Payment information: if you subscribe to a paid plan, billing details are collected and processed by our payment processor; we do not store full payment card numbers ourselves.

2. How We Use Information

We use the information described above to:

• Provide, maintain, and improve the Service, including generating structured notes from your dictation;
• Authenticate accounts and enforce agency membership and permissions;
• Process payments and manage subscriptions;
• Communicate with you about your account or the Service;
• Maintain security, audit logs, and prevent misuse of the Service;
• Comply with legal obligations, including maintaining records required under our Business Associate Agreements where applicable.

We do not sell your personal information, and we do not use your voice recordings or generated notes to train our own general-purpose AI models.

3. How Voice Data Is Processed

When you use the recording feature, your spoken audio is converted to text using one of the following, depending on your organization's settings and browser:

• Web Speech API(Chrome, Safari, Edge): your browser's built-in speech recognition, provided by Apple or Google depending on your browser, for organizations not on a HIPAA-enabled Enterprise plan.
• Microsoft Azure Speech Services: used for organizations on a HIPAA-enabled Enterprise plan, and as a fallback on browsers that do not support the Web Speech API.
• On-device recognition (iOS app): for organizations on a HIPAA-enabled Enterprise plan, speech recognition is performed entirely on your device; audio is never transmitted to a third party.

In every case, Chartless does not receive, transmit to its own servers, or store your raw audio.The verbatim transcription text is used to generate your structured note. While a note remains an unapproved draft, the transcript is retained so you can resume and review it later; once a note is approved or rejected, the transcript is permanently deleted and only the AI-generated structured note — the content you reviewed and approved — remains as your organization's record.

4. Third-Party Subprocessors

We share information with the following subprocessors to provide the Service:

• Amazon Web Services, Inc. — stores client, subject, and note records, and generates AI-assisted note content from your transcription (Amazon Bedrock).
• Microsoft Corporation — converts voice recordings to text for organizations on a HIPAA-enabled Enterprise plan, or as a fallback on unsupported browsers.
• Supabase, Inc. — authenticates accounts and stores organization, membership, and billing-status records.
• Vercel Inc. — hosts and serves the Chartless web dashboard.
• Stripe, Inc. — processes subscription payments and stores billing information on paid plans.
• Resend (Plus Five Five, Inc.) — sends account-related emails, such as password resets and staff invitations.
• Sentry (Functional Software, Inc.) — receives technical diagnostic information when the Service encounters an unexpected error, to help us identify and fix issues.

Amazon Web Services and Microsoft are the only subprocessors above that can receive protected health information, and are covered by our Business Associate Agreement for organizations on a HIPAA-enabled Enterprise plan. We do not share your information with any other third party for their own marketing purposes.

5. Data Storage and Retention

Client records and generated notes are retained for as long as your organization maintains an active account, so that your organization can access its own documentation history. We don't apply a fixed expiration date to that data — retention is tied to how long your organization keeps its account, not a set number of days.

Any user can permanently delete their own account — including, for an agency owner, their organization's account and all associated data — at any time from Manage Account within the Service. This takes effect immediately: once submitted, the data is removed from our production systems right away, not on a delayed schedule. If you're unable to access your account, you can instead request deletion by contacting info@chartlessapp.com; because that path is handled by our team rather than the automated in-app flow, it is not instant, though we process these requests promptly. For organizations on a HIPAA-enabled Enterprise plan, our Business Associate Agreement governs deletion of protected health information to the extent it differs from this section.

Deleting an individual chart works differently depending on its status. A draft chart is deleted permanently and immediately. An approved or rejected chart is removed from view immediately, then permanently deleted from our systems within 30 days — a brief recovery window that protects against an accidental or improper deletion of a finalized record, not a way for us to access or use the content in the meantime.

Raw audio is never retained, as described in Section 3. Verbatim transcription text is retained only while a chart remains an unapproved draft, and is permanently deleted the moment it's approved or rejected.

Your organization is solely responsible for maintaining any records required by applicable law, including determining and complying with the record-retention periods that apply to your business. Once data is deleted through the Service, we do not retain it for your future access, except for a limited period in backups maintained for disaster-recovery purposes.

6. Protected Health Information

The standard Service is not designed or intended for protected health information (PHI), and we do not offer HIPAA compliance mode or a Business Associate Agreement on standard accounts. If your organization handles PHI, contact us about a HIPAA-enabled Enterprise plan; PHI may only be recorded or stored through the Service once a Business Associate Agreement has been separately executed for that account. See our Terms of Service for what using the standard Service to record or store PHI without one means for your account.

7. Data Security

We use industry-standard safeguards to protect your information, including encryption of data in transit and at rest, access controls limiting who can view your organization's data, audit logging on systems that process voice data, and multi-factor authentication on administrative access to the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Cookies

We use only strictly necessary cookies — specifically, a session cookie set by our authentication provider (Supabase) to keep you signed in. We do not use cookies for advertising or analytics, and we do not use any third-party tracking or analytics scripts on the Site. Because we only use cookies that are essential to providing the Service, no cookie consent banner is shown; you can still block or delete cookies through your browser settings, though doing so will prevent you from staying signed in.

9. Your Rights and Choices

Depending on where you live, you may have rights under applicable privacy laws (such as the California Consumer Privacy Act and similar state laws) to request access to, correction of, or deletion of your personal information, or to opt out of certain uses. To exercise these rights, contact us at info@chartlessapp.com. If your organization's data includes information about clients or subjects who are not Chartless account holders, requests concerning that information should generally be directed to the organization that maintains the account, as they control that data.

10. Children's Privacy

The Service is intended for business use by adults and is not directed to children under 18, consistent with our Terms of Service. We do not knowingly collect personal information directly from children through the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify account owners directly.

12. Contact Us

Questions about this Privacy Policy can be sent to info@chartlessapp.com.

Effortless Solutions LLC
1207 Delaware Ave, Unit 345
Wilmington, DE 19806